nerdexam
(ISC)2

CGRC · Question #355

The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Pub

The correct answer is A. Compensating Security Controls. This question defines security controls used as alternatives to recommended baseline controls, providing equivalent protection for an information system.

Selection and Approval of Framework, Security, and Privacy Controls

Question

The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Publication 800-53 and CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. Response:

Options

  • ACompensating Security Controls
  • BCommon Security Controls
  • CNetwork Security Controls
  • DHybrid Security Controls

How the community answered

(27 responses)
  • A
    89% (24)
  • C
    4% (1)
  • D
    7% (2)

Why each option

This question defines security controls used as alternatives to recommended baseline controls, providing equivalent protection for an information system.

ACompensating Security ControlsCorrect

Compensating Security Controls are alternative management, operational, or technical controls employed when it is not feasible or practical to implement the recommended controls from established baselines like NIST SP 800-53. These controls are specifically designed to provide equivalent or comparable protection, ensuring the information system maintains an acceptable level of security. They are an integral part of risk management strategies.

BCommon Security Controls

Common Security Controls are inherited by multiple information systems, not replacements for specific recommended controls.

CNetwork Security Controls

Network Security Controls are a type of technical control related to network infrastructure, not a category for alternative controls.

DHybrid Security Controls

Hybrid Security Controls combine common and system-specific controls, which is a different concept from compensating for a missing recommended control.

Concept tested: Compensating security controls

Source: https://csrc.nist.gov/glossary/term/compensating_security_control

Topics

#Compensating Controls#Security Controls#NIST SP 800-53#Control Baselines

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice